New privacy law may only cover only digital data at first

The data protection bill that is being redrawn after being withdrawn in Parliament by the government earlier this month will initially only cover digital personal data and not records on paper, people aware of the matter said, adding that possible legacy provisions will be included to cover any data that is subsequently digitised.

The move will include making a distinction between digitised and non-digitised data, according to internal discussions held at the ministry of electronics and information technology. “The government is still working on how to segregate the two, with a special focus on ensuring safety of sensitive personal data,” said one official, asking not to be named.

“The ultimate aim will be to digitise all data, but the bill, as it is shaping up, is likely to only apply to digital data initially,” the official added.

But, this person said, a legacy provision will be included to cover any data later digitised. “Think of birth certificates that are old, and so far, only maintained as physical records. Over time, they will be digitised and all forms of personal data will be protected under the bill,” the official added.

A second official said that the Bill will be a truncated version as compared to the report that was tabled by the Joint Committee of Parliament in December 2021. “The idea is to make the bill less complicated and more easily accessible,” the second official said.

The first official added that the problems remain the same, and will have to be addressed in the new bill. The bill will be put for public consultation once it is finalised. “To try and apply the laws to data that is on paper will take extensive time. Right now the need is to prioritise privacy of citizens and provide a mechanism to ensure it,” the official said. “There are other recourses that citizens can take if data which is on paper is missed.”

“Sensitive personal data will have to be tackled with great care and the government is taking all necessary steps to ensure its safety,” the official reiterated.

Experts, however, raised some concerns over the delay. “Legacy provisions were weak to begin with for digitised data and clarity and precision were hoped for from the new law. Unfortunately, it appears that there will be more delays for this,” said Supreme Court lawyer and founder of Cybersaathi NS Nappinai. “The first leaked version of the privacy law draft of 2011 itself explicitly covered digital and digitised data.”

She added that whilst simplicity and clarity are welcome, ensuring a comprehensive law is equally essential.